Executive brief
CatalogX is a WordPress plugin used to manage product enquiries and catalogs. The plugin's Enquiry module fails to properly sanitize user input stored in a shared cache (transient), allowing an unauthenticated attacker to inject malicious content that gets rendered unescaped in administrator notification emails. When legitimate customers submit product enquiries, they receive admin emails containing the attacker's injected payload, which could be used for phishing or information disclosure.
Technical details
This is a stored content injection vulnerability in the CatalogX plugin's enquiry notification system. The vulnerable AJAX action "add_variation_for_enquiry_mail" lacks nonce and capability checks, allowing unauthenticated users to poison the shared "variation_list" transient with arbitrary markup. When any customer later submits a product enquiry for a variable product, the plugin renders the cached payload unescaped in the email template using ucfirst() without output encoding. Attack preconditions include an active Enquiry module, published variable products, and default permissions allowing unauthenticated enquiry submission. The vulnerability was patched in version 6.1.3.
Affected products
- WooCommerce Catalog Enquiry before 6.1.3
Timeline
- 2026-08-31: disclosed
- 2026-09-02: patched: Fixed in version 6.1.3